Deleting the install folder is recommended by OpenCart straight away right after installation. OpenCart will alert you from the administration In the event the install folder will not be deleted. Using .htaccess, you'll be able to deny all IP addresses from viewing your store, apart from the admin's IP address. https://gregoryuckov.blog-ezine.com/31936841/rumored-buzz-on-tomatocart-vs-opencart